Privacy policy

1. Information we collect

Information you provide

• Account registration details (name, email address, phone number, company name)
• Billing and payment information
• Contact form messages and demo account requests: your name and email address, and, if you choose to give them, your phone number, business name, type of business and a message
• Communications with our support team
• Data entered into the Platform by you and your Users (Customer Data)

Information collected automatically

• Device and browser information
• IP address and approximate location
• Pages visited, time spent, and navigation patterns on our website
• How you use pages on our website, such as clicks, scrolling and mouse movement (see Website analytics below)
• Cookies and similar tracking technologies (see our Cookie Policy)

Medical and sensitive information

If you use the BX1X Medical module, the Platform may process special personal information as defined by POPIA, including patient health records, medical aid details, and clinical notes. This data is processed solely on your instruction as the responsible party. We act as an operator (processor) of this data.

2. Website forms, demo accounts and WhatsApp

When you send a form on our website (a general enquiry, a switching-over request, a support request, or a demo account request), we collect your name and email address, and, if you choose to give them, your phone number, business name, type of business and a message. The details you enter are emailed to our team so we can reply, and we send you an email to confirm we received them.

When you ask for a demo account, we also use your name and email address to set up your own login to a demo of the Platform and to email you your login details. Demo accounts are filled with sample data. Please do not enter real customer, patient or other personal information into a demo account.

Our forms use Cloudflare Turnstile to check that a form is sent by a person and not an automated program, and we limit how many forms can be sent from one connection in a short time. Both help protect you and us from spam and abuse.

If you message us on WhatsApp (for example, through a “WhatsApp us” link on this website), your phone number and the content of your message reach our team through WhatsApp Business. WhatsApp is provided by WhatsApp Ireland Limited / Meta, and processes that message under WhatsApp’s own privacy policy and terms, which we do not control. We use your WhatsApp number and message only to reply to you, and we do not add it to a marketing list without your consent.

3. Website analytics

We use two analytics services on bx1x.com to understand how visitors use the website, so we can improve it:

• Google Analytics tells us which pages are visited, how long visitors stay and how they arrived.
• Microsoft Clarity records how visitors use our pages, such as clicks, scrolling and mouse movement, and shows this to us as session replays and heatmaps.

These services set cookies and are provided by Google and Microsoft, who process the information on our behalf. This website does not show a cookie banner. You can block or delete these cookies in your browser at any time; our Cookie Policy explains how.

4. How we use your information

We use personal information to:

• Provide, operate, and maintain the Service
• Set up a demo account you ask for and send you its login details
• Reply to messages you send us
• Process payments and manage your subscription
• Communicate with you about your account, support requests, and service updates
• Improve and develop the Platform and our website
• Comply with legal obligations
• Protect the security and integrity of the Service

We do not sell your personal information. We do not use your Customer Data for advertising or marketing purposes.

5. Legal basis for processing (POPIA)

We process personal information on the following lawful grounds:

• Consent: where you have given explicit consent (for example, contact form messages and demo account requests).
• Contract: where processing is necessary to perform our obligations under the subscription agreement.
• Legitimate interest: where processing is necessary for our legitimate business interests (for example, improving the Service and our website, preventing fraud and spam).
• Legal obligation: where we are required to process data by law.

6. Data sharing

We may share personal information with:

• Service providers: third-party providers who assist in operating the Service and our website (for example, hosting providers, payment processors, email delivery services, website analytics from Google and Microsoft, and form protection from Cloudflare). These providers are bound by data processing agreements.
• Legal requirements: where required by law, court order, or regulatory authority.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

We do not share Customer Data with other customers or unrelated third parties.

7. Data storage and security

• Traffic to the Platform is encrypted over HTTPS, and database connections in production are encrypted.
• Backups made through our administration systems are encrypted before they are stored.
• Access to personal information is restricted to authorised personnel on a need-to-know basis.
• We maintain role-based access controls, audit trails, and logging across the Platform.
• The Platform can run in the cloud, on your own private server or on your premises, so you can choose how it is hosted.
• We maintain technical and organisational measures to protect against unauthorised access, loss, or destruction of data, including controlled credential rotation and a documented incident response process.

8. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service. When your subscription ends, you can ask us for a copy of your data for 30 days. After that it is securely deleted. A backup is taken before deletion.

Certain information may be retained longer where required by law or for legitimate business purposes (for example, billing records and tax compliance).

9. Information Officer

Villiers Vision Works (Pty) Ltd has an Information Officer, responsible for compliance with POPIA and for handling requests about personal information. Our Information Officer can be reached at info@bx1x.com or +27 87 150 9305.

10. Your rights under POPIA

As a data subject, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal retention requirements
• Object to the processing of your personal information
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at info@bx1x.com.

11. Cross-border data transfers

Where data is transferred outside of South Africa (for example, to cloud infrastructure providers or to the analytics services named above), we ensure that appropriate safeguards are in place in accordance with POPIA Section 72, including ensuring that the recipient country has adequate data protection laws or that binding agreements are in place.

12. Children's privacy

The Service is not directed at children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the Platform. The “Last updated” date at the top of this page shows the most recent revision.

14. Contact

For privacy-related enquiries or to exercise your data subject rights:

You may also lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.